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NRS Audit and Risk Committee (ARC) Meeting 
28 May 2020 
By teleconference 


Colin Ledlie NRS Non-Executive Director (Chair) 
Christine Martin NRS Non-Executive Director 

Bill Matthews NRS Non-Executive Director 

Asif Haseeb External Auditor — Audit Scotland 
Jonny Steen External Auditor — Audit Scotland 

Kate Moffat Internal Auditor — Scottish Government 
Lorraine Twyford Internal Auditor - Scottish Government 
Paul Lowe NRS, Chief Executive 

Linda Sinclair NRS, Director of Corporate Services & Accountable officer 
Steven Hanlon NRS, Chief Financial Officer 

Lesley Smillie Census Director Team (item 5) 


Shirley Cameron NRS, Business Management, secretariat 


1. Welcome, Introductions and Declaration of Interests 


1.1 The Chair welcomed everyone to the meeting, including Kate Moffat, SG 
Internal Audit, attending for her first meeting. 


1.2 No apologies were noted. 
1.3 There were no new Declarations of Interest. 


2. Minutes and Actions 


2.1 The minutes of 5 March 2020 were accepted. The minutes would be published 
on the NRS website, governance page. 


2.2 Actions were reviewed as follows: 


2.3 Action A07/19: Induction and training opportunities for ARC. The action had 
been postponed due to the impact of Covid-19 pandemic. Action: ongoing. 


2.4 Other actions were noted as completed. The action log would be updated 
accordingly. 


3. NRS Update -Paul Lowe 


3.1 Paul Lowe provided an overview of the activities since the last meeting of ARC 
on 5 March 2020. Most notably the impact of the Covid-19 pandemic on the delivery 
of services, as well as actions taken to deliver business continuity while safeguarding 
customers and staff during lockdown. 
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3.2 The approach to recommence services when safe to do so and within SG 
guidelines was being considered. 


3.3 Plans for the delivery of the Census 2021 Programme in light of Covid-19 had 
been assessed to understand impacts and mitigating options. 


3.4 Other areas of focus in relation to the Covid-19 pandemic had included 
significant registration service changes, working in partnership with Local Authorities 
and facilitated by emergency legislation. NRS had also undertaken significant work to 
produce statistical publications and analysis in relation to Covid-19 related mortality. 


4. Risk Deep Dive — Covid 19 Risks Including Business Continuity — Linda 
Sinclair. 


4.1 Linda Sinclair introduced the paper which described the NRS response to 
Covid-19 risks and the business continuity approach taken during the pandemic. The 
report described: 


e Invoking the Business Continuity Plan. 
Incident Management Team. 
Prioritisation of critical activities. 
NRS organisational response. 
NRS approach to identifying and managing COVID-19 Risks. 
COVID-19 risks identified by Directorates and mitigations included the following : 
o People — increased home working, balance of care and work 
responsibilities, and staff wellbeing. 
o Recruitment — restrictions impacting on delivery of key priorities. 
o Customer demand — surge in demand when services recommence 
creating pressures. 
o Health and safety — compliance in relation to home working alongside 
plans to consider re-opening of buildings, as allowed. 
o Business delivery — impact due to home working restrictions impacting on 
delivery commitments or increased costs from programmes and projects. 
e COVID-19 risk impacts on corporate risks. 
e Business Continuity Plan - incident response structure. 


4.2 |The Committee noted the report which was discussed as follows: 


e It was noted that emergence from lockdown would likely be complex and 
staged. 

e The resilience of NRS to provide high quality support in relation to issues of 
importance for Scotland was noted. 

e There was a discussion in relation to staff wellbeing. It was confirmed that 
support and resources had been made available to staff with a dedicated well 
being area on the NRS staff intranet. 
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e lt was noted that NRS was participating in a Cabinet Office sponsored Covid- 
19 people survey. The results would inform further support and information for 
staff. 


5. NRS Deep Dive 2: NRS Census 2021 - Risk Management — Lesley Smillie 
5.1 Lesley Smillie provided an overview of the presentation which included: 


e Areview of the impact of Covid-19 on the programme. 

e An overview of the Census delivery options assessment approach, findings and 
recommendations. 

e Findings of a strategic risk review of Census Programme risk themes 
following Covid-19 impact analysis. 


5.2 The Committee discussed the report as follows: 


e lt was noted that quality would be a key critical success factor for the census.. 

e Covid -19 was impacting the delivery of the programme over the previous 11 
weeks. It was anticipated that a disruption period of 6 months or more was likely 
and this had been used as the basis of the impact assessment. 

e The Committee heard that the programme team continued to engage closely 
with ONS and NISRA in relation to the delivery of the census in the Rest of the 
UK. 

e The impact assessment work had been subject to an independent Gateway 
Review. The findings indicated that an appropriate and robust exercise had 
been undertaken. 

e The process and timeline for a decision by Ministers on the options appraisal 
was noted. 


5.3 The Committee noted the report and were supportive of the recommendations 
made to Scottish Ministers. 


6. NRS Governance Report -— Linda Sinclair 


6.1 Linda Sinclair introduced the paper, which provided a summary of activity 
across NRS internal systems of control. The following topics were raised by the 
committee: 


e There was a request for further information about the results of the most 
recent IT Healthcheck. Linda Sinclair undertook to bring further information 
back to the Committee. 

e An update in relation to the risk ‘NRS 11 / Technology / Threat’, appeared to 
be outstanding with the last update notes as February 2020. This would be 
followed up. 
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Action A03/20: Governance report: Inclusion of further details in relation to IT 
vulnerabilities would be considered with head of IT Services. Owner: Linda Sinclair. 


Action A04/20: Governance report: Update for risk ‘NRS 11 / Technology / Threat’ 
to be reviewed for currency. Owner: Linda Sinclair 


7. NRS Finance Report- Steven Hanlon 


7.1 Steven Hanlon presented the finance report, which included the provisional 
financial outturn for the 2019-2020 financial year, as well as providing an assessment 
of the impact of Covid-19 on National Record of Scotland’s 2020/2021 financial 
position. 


7.2 |The Committee noted the report and discussed the Covid-19 impact as follows: 


e Income had been impacted due to the closure of Extract Services. An increased 
usage of ScotlandsPeople had also been noted 

e The annual efficiency saving target was discussed. Steven Hanlon confirmed 
that NRS had a good track record of meeting this and that he remained 
comfortable that this would be achieved in 2020-21. 


8. Draft NRS Annual Report and Accounts 2019-2020 — Steven Hanlon 


8.1 Steven Hanlon introduced the item and invited the Committee to note the first 
draft of the NRS Annual Report and Accounts 2019-2020. 


8.2 The timetable for development of the report had been slightly impacted by 
Covid-19 but it was still anticipated that the document would be completed to the 
original timescale. The final version was expected to be presented to ARC for review 
at the September meeting. The committee thanks Steven and NRS for the work to 
progress the report under the current challenging conditions. 


9. NRS Assurance Activities — Linda Sinclair 
9.1 The Committee noted the paper, n o comments were received. 
10. NRS Audit Recommendations Status Report — Linda Sinclair 
10.1 The Committee noted and discussed the paper as follows: 
e SG Internal Audit indicated a change in their policy. IA would no longer follow- 
up on low level audit recommendations, NRS management would consider and 


sign off as appropriate. 


11. Internal Audit Annual Assurance Report 2019-2020(draft) and Plan 2020- 
2021, Q1 progress — Kate Moffat/Lorraine Twyford 
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11.1 Kate Moffat provided an overview of impacts, to SG Internal Audit resource, as 
a result of Covid-19, including redeployment of staff. It was noted that the 2019-20 
audit activity had been concluded. The plan for 2020-2021 was discussed, it was noted 
that the planned audits would proceed, however it was likely that the anticipated dates 
were likely to be rescheduled. Flexibility had been retained in the plan should it be 
required. 


11.2 The annual assurance report had concluded and was indicating a final Internal 
Audit opinion of ‘reasonable assurance’. It was noted that the three substantive audits 
undertaken during the year had all received “substantial assurance.” The Committee 
praised NRS for the achievement of these results and noted the improvement in the 
overall audit opinion for the year. 


12. External Audit — Interim Management Report 2019-2020 
12.1 Asif Haseeb provided an update to the committee. 


12.2 He confirmed that there was appropriate and effective internal controls were in 
place overall for the key financial systems reviewed. The audit testing had identified 
some less significant issues to the NRS control environment which had been reported 
to management for action. 


13. Draft ARC Annual Report to the NRS Chief Executive, Accountable Officer 
and Strategic Board - 2019-2020 


13.1 The Chair presented the draft report to the Committee and invited comments. 
The draft report would be reviewed in line with the assurance reports received from 
internal and external audit and would be submitted for consideration at the next 
meeting. 


14. ARC Forward Look for year ahead & EMB Forward Look. - Linda Sinclair 


14.1 The report was included for information of the proposed business for the next 
twelve months. It was noted that some flexibility around deep dives would be 
considered as risks in relation to Covid-19 pandemic develop. 


15. Date of Next Meeting — 3 September 2020 
END 


